Vulnerability · Published May 5, 2025 · Assigned by VulDB
CVE-2025-4281Shenzhen Sixun Software Sixun Shanghui Group Business Management System LoadData information disclosure
Medium 4.3
In plain English
A medium-severity information exposure in Sixun Shanghui Group Business Management System from Shenzhen Sixun Software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Official description
A vulnerability, which was classified as problematic, was found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 7. This affects an unknown part of the file /api/GylOperator/LoadData. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Shenzhen Sixun Software | Sixun Shanghui Group Business Management System | 7 |
Weakness: CWE-200, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- VDB-307389 | Shenzhen Sixun Software Sixun Shanghui Group Business Management System LoadData information disclosure vdb-entry
- VDB-307389 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #563515 | Shenzhen Sixun Software Co., Ltd Sixun Shanghui 7 Group Business Management System 7 Unauthorized information disclosure third-party-advisory
- https://github.com/zhangbuneng/an-unauthorized-vulnerability-in-the-business-management-system-of-Wisdom-7-Group/issues/1 exploit, issue-tracking